CWE-843
CVEs classified under CWE-843, newest first.
258 CVEsRSS
CVE-2026-114598High· 7.5Access of resource using incompatible type ('type confusion') in EPICS Base
In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length values in a network message can cause the application to read beyond the bounds of an allocated buffer. This may lead to denial of service and could …
CVE-2026-116370Medium· 6.3PoC2K Games Sid Meier's Civilization VI Lua sandbox loadstring type confusion
A security flaw has been discovered in 2K Games Sid Meier's Civilization VI 1.0.12.68. The affected element is the function loadstring of the component Lua sandbox. Performing a manipulation results in type confusion. The attack may be i…
CVE-2026-116489High· 7.5Timescale pgvectorscale before 0.9.1 Type Confusion via Unqualified DiskANN Operator Classes
Timescale pgvectorscale before 0.9.1 contains a type confusion vulnerability that allows low-privileged database users to corrupt memory by shadowing pgvector's vector type or operators. Attackers with CREATE privilege on the vectorscale…
CVE-2026-116111Medium· 6.3PoC2K Games Civilization V Lua Sandbox loadstring type confusion
A vulnerability was determined in 2K Games Civilization V 1.0.3.144. Impacted is the function loadstring of the component Lua Sandbox. Executing a manipulation can lead to type confusion. The attack may be performed from remote. The expl…
CVE-2026-115889Critical· 9.9Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted…
CVE-2026-114115Low· 3.7Vyper 0.3.8 through 0.5.0b1 Memory Misread via Ternary Nested Array Selection
Vyper 0.3.8 through 0.5.0b1 contains a compiler miscompilation vulnerability in parse_IfExp that reads nested arrays with narrower inner bounds using the wider result type's memory layout. When a ternary selects the narrower array, inner…
CVE-2026-108518Medium· 4.7perl-dbi: perl-dbi: Denial of Service via type confusion in dbi_profile (CVE-2026-108518)
A flaw was found in the perl-dbi package. A type confusion vulnerability in the profiling feature can lead to an invalid memory dereference, causing the application to crash and resulting in a Denial of Service (DoS). A user or attacker ca…
CVE-2026-113055High· 8.8Type confusion in FullScreen in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page
Type confusion in FullScreen in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-115892Medium· 5.7Panic lowering a host-created component model stream into a guest that expects a different payload type
Panic lowering a host-created component model stream into a guest that expects a different payload type
CVE-2026-110674NoneCpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref in decode_hv
Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref in decode_hv. With allow_barekey, which relaxed enables, a bare key containing a non-ASCII by…
CVE-2026-98821Medium· 4.7kernel: block: reject polled dio with user integrity metadata (CVE-2026-98821)
A flaw was found in the Linux kernel's block layer. A local user could exploit this vulnerability to cause a denial of service (DoS) by initiating polled direct I/O operations combined with user integrity metadata. Because the kernel impro…
CVE-2026-98833Medium· 5.5kernel: mtd: core: call _get_device() with the master MTD (CVE-2026-98833)
A flaw was found in the Linux kernel's Memory Technology Device (MTD) subsystem. When accessing certain partitions, the kernel improperly passes a partition device reference instead of the master device structure to the driver callback. A …
CVE-2026-98557Medium· 5.5kernel: gve: DQO: fix header length used by gve_can_send_tso() for UDP GSO (CVE-2026-98557)
A flaw was found in the Google Virtual Ethernet (gve) driver in the Linux kernel. This vulnerability may allow a local attacker to cause a Denial of Service (DoS) by transmitting network traffic that uses User Datagram Protocol (UDP) Gener…
CVE-2026-0314Medium· 4.3A type confusion vulnerability in Palo Alto Networks GlobalProtect™ app on Windows enables a local user with low privileges to cause a denial of service (DoS) condition. The GlobalProtect™ app on Linux, macOS, iOS, Android, and Chrome O…
A type confusion vulnerability in Palo Alto Networks GlobalProtect™ app on Windows enables a local user with low privileges to cause a denial of service (DoS) condition. The GlobalProtect™ app on Linux, macOS, iOS, Android, and Chrome O…
CVE-2026-110140High· 8.8Type confusion in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page
Type confusion in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-96921Medium· 5.5Access of resource using incompatible type ('type confusion') in Windows Message Queuing Queue Manager allows an authorized attacker to disclose information locally.
Access of resource using incompatible type ('type confusion') in Windows Message Queuing Queue Manager allows an authorized attacker to disclose information locally.
CVE-2026-96854Medium· 5.5Access of resource using incompatible type ('type confusion') in Windows Device Association Service allows an authorized attacker to disclose information locally.
Access of resource using incompatible type ('type confusion') in Windows Device Association Service allows an authorized attacker to disclose information locally.
CVE-2026-85377High· 7.8Access of resource using incompatible type ('type confusion') in Windows CD-ROM Driver allows an authorized attacker to elevate privileges locally.
Access of resource using incompatible type ('type confusion') in Windows CD-ROM Driver allows an authorized attacker to elevate privileges locally.
CVE-2026-83763High· 7.8Access of resource using incompatible type ('type confusion') in Windows Input System allows an authorized attacker to elevate privileges locally.
Access of resource using incompatible type ('type confusion') in Windows Input System allows an authorized attacker to elevate privileges locally.
CVE-2026-83664Medium· 5.5Access of resource using incompatible type ('type confusion') in Windows Portable Device File System Driver allows an authorized attacker to disclose information locally.
Access of resource using incompatible type ('type confusion') in Windows Portable Device File System Driver allows an authorized attacker to disclose information locally.
CVE-2026-83642High· 8.8Access of resource using incompatible type ('type confusion') in DNS Server allows an unauthorized attacker to execute code over a network.
Access of resource using incompatible type ('type confusion') in DNS Server allows an unauthorized attacker to execute code over a network.
CVE-2026-70245High· 7.8Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
CVE-2026-70225High· 7.8Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
CVE-2026-70205High· 7.0Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
CVE-2026-70167High· 8.8Access of resource using incompatible type ('type confusion') in DNS Server allows an authorized attacker to execute code over a network.
Access of resource using incompatible type ('type confusion') in DNS Server allows an authorized attacker to execute code over a network.
CVE-2026-70051High· 7.8Access of resource using incompatible type ('type confusion') in Windows SmartScreen allows an authorized attacker to elevate privileges locally.
Access of resource using incompatible type ('type confusion') in Windows SmartScreen allows an authorized attacker to elevate privileges locally.
CVE-2026-70017Medium· 5.5Access of resource using incompatible type ('type confusion') in Windows Secure Kernel Mode allows an authorized attacker to disclose information locally.
Access of resource using incompatible type ('type confusion') in Windows Secure Kernel Mode allows an authorized attacker to disclose information locally.
CVE-2026-69926High· 7.8Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
CVE-2026-69880High· 7.8Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
CVE-2026-102869High· 8.8Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.
Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.